diff --git a/core/lib/Drupal/Core/Field/Plugin/Field/FieldType/PasswordItem.php b/core/lib/Drupal/Core/Field/Plugin/Field/FieldType/PasswordItem.php
new file mode 100644
index 0000000..d7d2ded
--- /dev/null
+++ b/core/lib/Drupal/Core/Field/Plugin/Field/FieldType/PasswordItem.php
@@ -0,0 +1,22 @@
+<?php
+
+/**
+ * @file
+ * Contains \Drupal\Core\Field\Plugin\Field\FieldType\PasswordItem.
+ */
+
+namespace Drupal\Core\Field\Plugin\Field\FieldType;
+
+/**
+ * Defines the 'password' entity field type.
+ *
+ * @FieldType(
+ *   id = "password",
+ *   label = @Translation("Password"),
+ *   description = @Translation("An entity field containing a password value."),
+ *   no_ui = TRUE,
+ *   default_widget = "string",
+ *   default_formatter = "string"
+ * )
+ */
+class PasswordItem extends StringItem {}
diff --git a/core/modules/serialization/serialization.services.yml b/core/modules/serialization/serialization.services.yml
index f32fac0..4c9397a 100644
--- a/core/modules/serialization/serialization.services.yml
+++ b/core/modules/serialization/serialization.services.yml
@@ -25,6 +25,11 @@ services:
     class: Drupal\serialization\Normalizer\ListNormalizer
     tags:
       - { name: normalizer }
+  serializer.normalizer.password_field_item:
+      class: Drupal\serialization\Normalizer\NullNormalizer
+      arguments: ['Drupal\Core\Field\Plugin\Field\FieldType\PasswordItem']
+      tags:
+        - { name: normalizer, priority: 20 }
   serializer.normalizer.typed_data:
     class: Drupal\serialization\Normalizer\TypedDataNormalizer
     tags:
diff --git a/core/modules/serialization/src/Normalizer/NullNormalizer.php b/core/modules/serialization/src/Normalizer/NullNormalizer.php
new file mode 100644
index 0000000..eec36d9
--- /dev/null
+++ b/core/modules/serialization/src/Normalizer/NullNormalizer.php
@@ -0,0 +1,32 @@
+<?php
+
+/**
+ * @file
+ * Contains \Drupal\serialization\Normalizer\NullNormalizer.
+ */
+
+namespace Drupal\serialization\Normalizer;
+
+/**
+ * Null normalizer.
+ */
+class NullNormalizer extends NormalizerBase {
+
+  /**
+   * Constructs a NullNormalizer object.
+   *
+   * @param string|array $supported_interface_of_class
+   *   The supported interface(s) or class(es).
+   */
+  public function __construct($supported_interface_of_class) {
+    $this->supportedInterfaceOrClass = $supported_interface_of_class;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function normalize($object, $format = NULL, array $context = array()) {
+    return NULL;
+  }
+
+}
diff --git a/core/modules/serialization/src/Tests/EntitySerializationTest.php b/core/modules/serialization/src/Tests/EntitySerializationTest.php
index d45c2a6..867b8a6 100644
--- a/core/modules/serialization/src/Tests/EntitySerializationTest.php
+++ b/core/modules/serialization/src/Tests/EntitySerializationTest.php
@@ -108,7 +108,12 @@ public function testNormalize() {
       $this->assertEqual($expected[$fieldName], $normalized[$fieldName], "ComplexDataNormalizer produces expected array for $fieldName.");
     }
     $this->assertEqual(array_diff_key($normalized, $expected), array(), 'No unexpected data is added to the normalized array.');
+  }
 
+  /**
+   * Tests user normalization.
+   */
+  public function testUserNormalize() {
     // Test password isn't available.
     $account = User::create([
       'name' => 'foo',
@@ -117,8 +122,18 @@ public function testNormalize() {
     ]);
     $account->save();
     $normalized = $this->serializer->normalize($account);
-    $this->assertTrue(empty($normalized['pass']));
-    $this->assertTrue(empty($normalized['mail']));
+
+    $this->assertFalse(array_key_exists('pass', $normalized));
+    $this->assertFalse(array_key_exists('mail', $normalized));
+
+    // Test again with a user that can view passwords, they should still not be
+    // visible. User the same user for this test, so access control will allow
+    // password viewing.
+    $normalized = $this->serializer->normalize($account, NULL, ['account' => $account]);
+
+    // [NULL] will be returned as the normalizer for password fields will only
+    // return NULL but the key will still exist.
+    $this->assertIdentical($normalized['pass'], [NULL]);
   }
 
   /**
diff --git a/core/modules/serialization/tests/src/Unit/Normalizer/NullNormalizerTest.php b/core/modules/serialization/tests/src/Unit/Normalizer/NullNormalizerTest.php
new file mode 100644
index 0000000..e79c07f
--- /dev/null
+++ b/core/modules/serialization/tests/src/Unit/Normalizer/NullNormalizerTest.php
@@ -0,0 +1,59 @@
+<?php
+
+/**
+ * @file
+ * Contains \Drupal\Tests\serialization\Unit\Normalizer\NullNormalizerTest
+ */
+
+namespace Drupal\Tests\serialization\Unit\Normalizer;
+
+use Drupal\serialization\Normalizer\NullNormalizer;
+use Drupal\Tests\UnitTestCase;
+
+/**
+ * @coversDefaultClass \Drupal\serialization\Normalizer\NullNormalizer
+ * @group serialization
+ */
+class NullNormalizerTest extends UnitTestCase {
+
+  /**
+   * The NullNormalizer instance.
+   *
+   * @var \Drupal\serialization\Normalizer\NullNormalizer
+   */
+  protected $normalizer;
+
+  /**
+   * The interface to use in testing.
+   *
+   * @var string
+   */
+  protected $interface = 'Drupal\Core\TypedData\TypedDataInterface';
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function setUp() {
+    $this->normalizer = new NullNormalizer($this->interface);
+  }
+
+  /**
+   * @covers ::__construct
+   * @covers ::supportsNormalization
+   */
+  public function testSupportsNormalization() {
+    $mock = $this->getMock('Drupal\Core\TypedData\TypedDataInterface');
+    $this->assertTrue($this->normalizer->supportsNormalization($mock));
+    // Also test that an object not implementing TypedDataInterface fails.
+    $this->assertFalse($this->normalizer->supportsNormalization(new \stdClass()));
+  }
+
+  /**
+   * @covers ::normalize
+   */
+  public function testNormalize() {
+    $mock = $this->getMock('Drupal\Core\TypedData\TypedDataInterface');
+    $this->assertNull($this->normalizer->normalize($mock));
+  }
+
+}
diff --git a/core/modules/user/src/Entity/User.php b/core/modules/user/src/Entity/User.php
index c003db2..70a602f 100644
--- a/core/modules/user/src/Entity/User.php
+++ b/core/modules/user/src/Entity/User.php
@@ -478,7 +478,7 @@ public static function baseFieldDefinitions(EntityTypeInterface $entity_type) {
         'UserNameUnique' => array(),
       ));
 
-    $fields['pass'] = BaseFieldDefinition::create('string')
+    $fields['pass'] = BaseFieldDefinition::create('password')
       ->setLabel(t('Password'))
       ->setDescription(t('The password of this user (hashed).'));